QASP - GovInfo-Public-Access-QASP (1)-05-24-2024.docx

GovInfo Public Access Subsystem Development and Support Quality Assurance Surveillance Plan (QASP)

Introduction The purpose of this Quality Assurance Surveillance Plan (QASP) is to evaluate contractor actions while implementing the Statement of Work (SOW). It is designed to provide an effective surveillance method of monitoring contractor performance for each task and deliverable outlined in the SOW. It also provides a systematic method to evaluate the services the contractor is required to furnish.

Standard The contractor is responsible for management and quality control actions to meet the terms of the contract. The contractor shall perform all work required in a satisfactory manner in accordance with the requirements of the SOW. The Contracting Officer’s Representative (COR) shall notify the Contracting Officer (CO) for appropriate action if it is unlikely that the contractor will be able to complete deliverables in accordance with the contract and quality levels identified below.

Contracting Officer The Contracting Officer (CO) is responsible for monitoring contract compliance, contract administration, and cost control and for resolving any differences between the observations documented by the Contracting Officer's Representative (COR) and the contractor. The CO will designate one full-time COR as the government authority for performance management. The number of additional representatives serving as technical inspectors depends on the complexity of the services measured, as well as the contractor’s performance, and must be identified and designated by the CO.

Contracting Officer’s Representative The Contracting Officer’s Representative (COR) is designated in writing by the CO to act as his or her authorized representative to assist in administering a contract. COR limitations are contained in the written appointment letter. The COR is responsible for technical administration of the program and ensures proper Government surveillance of the contractor’s performance. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the government’s behalf. Any changes that the contractor deems may affect contract price, terms, or conditions shall be referred to the CO for action. The COR will have the responsibility for completing any necessary QA monitoring forms used to document the inspection and evaluation of the contractor’s work performance. Government surveillance may occur under the inspection of supplies clause for any items in scope of the contract.

Performance Requirements Summary The COR will evaluate the performance objectives through surveillance as reflected below by reviews and acceptance of work products and services.

Code, configurations, and dependencies delivered under the contract must have substantial test code coverage, a clean code base, be properly styled, be functional, be free of medium, high, and critical level security vulnerabilities and must successfully built and deployed to the appropriate integration, QA, stage, production, COOP, or successor environments.

Configurations includes updates to support code and environment changes in all applicable environments, including updates and verification by automated configuration tests.

Goal of 80% automated test coverage of newly developed or modified code.

During SIT, at least 90% of RFC and Regression Test cards pass without rework.

Successful build, successful deployment, free of medium, and high, and critical level security vulnerabilities including documentation explaining any false positives as appropriate and determined by GPO.

Combination of manual review, integration testing, and the results from automated testing by Government personnel including clean test results from Program / GPO IT Security / IG monitoring and assessment tools (e.g., Foundstone, Nexus Repository checks, OWASP Dependency checks, sonar, findbugs, CheckStyle, code styling, linters, system configuration tests), along with documentation explaining any false positives.

Create user stories, acceptance criteria, and test steps. Update release and backlog issues within the GovInfo Program’s release and backlog management tools (e.g., Trello, GitLab, Azure DevOps).

Updates are made to GPO’s enterprise issue tracking tools.

As agreed to with the Program Manager, Product Owner, and COR after contract award.

Issues created and properly updated.

Combination of manual review and the results from automated testing, if available, by Government personnel.

Technology timeline includes lifecycle dates and refresh timelines for GovInfo technologies along with end of support dates, end of life dates, and security and update monitoring.

Updated Quarterly. Technology timeline is in English, and it does not contain spelling or grammatical errors.

Provided in Excel format or another format as proposed by the contractor and agreed to by the COR.

GPO will review updated Technology Timeline for accuracy and completeness, including adjustments from prior baseline.

UI/UX Design Deliverables

Mock-ups and/or design files if applicable, or design changes reflected in the development product. Includes update of design documentation.

Design documentation and artifacts are updated and checked into source code management tools (e.g., GitLab, Azure DevOps) by the end of each quarterly release for new and updated source code and functionality.

Design documentation deliverables are in English, and they do not contain spelling or grammatical errors.

GPO will evaluate and approve design deliverables for accuracy and completeness as part of criteria for deploying a release to production.

Analysis, Planning, and Implementation Documentation

Analysis or proposals for new technology or significant technology migration or upgrade planning documentation that includes recommendations or implementation plans, resources, activities, and timelines.

Analysis, proposals, plans, and documents are complete and address the required task.

Documentation deliverables are in English, and they do not contain spelling or grammatical errors.

GPO will evaluate and approve analysis, planning, and implementation deliverables for accuracy, completeness, and if the deliverables adequately address the required tasks.

Functionality in the software / source code is documented.

Documentation is checked in to GPO’s source code management tools (e.g., GitLab, Azure DevOps) and provided to GPO’s IT Configuration Management Branch Individual methods in source code are documented using comments.

All products delivered, deployed, and operational in the appropriate environment as appropriate for each sprint or release.

During SIT, at least 90% of RFC and Regression Test cards pass without rework.

Design documentation and artifacts are updated and checked into source code management tools (e.g., GitLab, Azure DevOps) by the end of each quarterly release for new and updated source code and functionality.

Design documentation deliverables are in English, and they do not contain spelling or grammatical errors.

Combination of manual review and the results from automated testing, if available, by Government personnel.

GPO will evaluate and approve design documentation for accuracy and completeness as part of criteria for deploying a release to production.

Testing Deliverables

Unit, regression, integration, and functional tests checked into tools and available for use.

Documentation of testing results.

Goal of 80% automated test coverage of newly developed or modified code.

Reviews and testing of code during SIT are at least 90% successful.

Combination of manual review and the results from automated testing, if available, by Government personnel.

Procedures, documentation, and automated scripts updated as appropriate in each sprint or release.

Procedures and documentation are in English, and they do not contain spelling or grammatical errors.

GPO will evaluate and approve support and operations deliverables for accuracy and completeness as part of criteria for deploying a release to production.

Within 5 business days of the beginning of each month.

Logs and the list of completed deliverables are in English, and they do not contain spelling or grammatical errors.

GPO will evaluate and approve logs and the list of completed deliverables for accuracy and completeness.